CVE-2026-59867: Microsoft Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
Microsoft Kiota resolved OpenAPI $refs by fetching remote http(s) URLs and reading local files
(including absolute / out-of-tree paths), inlining the referenced schema into the generated client.
Running kiota generate on a spec whose $ref pointed at an attacker/internal URL or an arbitrary
local file yielded SSRF, remote file inclusion, and local file inclusion. Verified on 1.32.3 / 1.32.4.
References
- github.com/advisories/GHSA-rg4h-fpcp-2qm8
- github.com/microsoft/kiota/commit/cccd798027f0a20db796b3df6c64f9897a39d7b1
- github.com/microsoft/kiota/pull/7888
- github.com/microsoft/kiota/releases/tag/v1.32.5
- github.com/microsoft/kiota/security/advisories/GHSA-rg4h-fpcp-2qm8
- nvd.nist.gov/vuln/detail/CVE-2026-59867
Code Behaviors & Features
Detect and mitigate CVE-2026-59867 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →